Here is a simple way to restrict access to your server from country’s that you don’t want to be able to connect to your services. On website www.ipdeny.com you can find IP lists for specific country’s. With a simple script, you can regularly update those lists so that they are up-to-date with new addresses. In my case, I needed a way to allow some services only available from specific countries. You can also change logic a little bit and blocking only specific county.
This will work on Linux server with installed iptables and ipset. Ipset will contain all addresses provided from ipdeny.com.
First, if you don’t already have it, install ipset.
[root@server ~]# dnf install ipset
Then, you’ll need to create ipset array which will contain all addresses.
ipset create allow_cc hash:net family inet hashsize 1024 maxelem 65536